2024-12-29_db52f2247fde87f2346bbd1aca404db7_smoke-loader_wapomi

Sharing

Copy URL

Twitter E-mail

General

Target

2024-12-29_db52f2247fde87f2346bbd1aca404db7_smoke-loader_wapomi
Size

284KB
MD5

db52f2247fde87f2346bbd1aca404db7
SHA1

3bea730bfeaf2b3bcf563c68efb301e6032b4331
SHA256

f7fb01a5fec86d5dc9381d0cba1f535d6f015a5139d4e47db6db52bd8420ef02
SHA512

d776d007b0c3b080097e1fc575fa6b99d17dceb6efef2518c85dd3fa563735e8e8dd59694dca0a64774578578a56ba0b79413c99fe95a827949d897d4fb9e4ee
SSDEEP

3072:nP4LkvMSNiHwDRD5zzzVVdH/UuIHTHbiy9tDyStTBfYnwgtX40SiewqMfNdarGCH:1gH+DxzDZ5CbD9ZyStTBPEqMff

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2024-12-29_db52f2247fde87f2346bbd1aca404db7_smoke-loader_wapomi

Files

2024-12-29_db52f2247fde87f2346bbd1aca404db7_smoke-loader_wapomi
.exe windows:4 windows x86 arch:x86

617ccccf07fc8671c9e93b185d832685

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

e:\views\platform_QQ1.40\Basic_HummerPlatform_VOB\Platform\Output\Bin\bugreport.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

dbghelp

SymCleanup
SymInitialize
SymSetOptions
SymLoadModule
SymGetModuleInfo

wininet

InternetCloseHandle
InternetOpenA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA

psapi

GetModuleFileNameExA

comctl32

ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx

kernel32

FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
QueryPerformanceCounter
FreeEnvironmentStringsW
GetEnvironmentStrings
WriteConsoleA
GetTempPathW
CreateDirectoryW
GetTickCount
DeleteFileW
CreateFileW
ReadFile
SetFilePointer
CloseHandle
GetVersionExW
VirtualQueryEx
CreateFileA
OpenThread
FindResourceW
GetProcAddress
GetModuleHandleW
ReadProcessMemory
WriteProcessMemory
SizeofResource
LockResource
LoadResource
FindResourceExW
HeapAlloc
GetProcessHeap
WriteFile
VirtualProtect
SetEvent
HeapFree
GetCurrentProcessId
CreateProcessW
OpenProcess
GetModuleFileNameW
SetCurrentDirectoryW
GetConsoleOutputCP
InterlockedDecrement
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FreeLibrary
GetLastError
Sleep
WideCharToMultiByte
GetFileSize
LoadLibraryW
GetThreadSelectorEntry
GetFileAttributesW
GetCurrentThreadId
FreeEnvironmentStringsA
GetStringTypeW
GetStringTypeA
HeapCreate
VirtualAlloc
VirtualFree
LoadLibraryA
GetModuleFileNameA
GetStdHandle
LCMapStringW
LCMapStringA
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
RtlUnwind
GetStartupInfoW
GetSystemTimeAsFileTime
ExitProcess
GetModuleHandleA
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
MultiByteToWideChar
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
WriteConsoleW
SetEndOfFile
InterlockedIncrement
GetCommandLineA
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
HeapSize
HeapReAlloc
HeapDestroy

user32

DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
UnregisterClassA
CallWindowProcW
ClientToScreen
DrawIconEx
EnableWindow
SetWindowTextW
IsWindow
SetDlgItemTextW
SetWindowPos
CloseClipboard
SetClipboardData
SendMessageW
LoadIconW
OpenClipboard
GetKeyState
RegisterClipboardFormatW
InvalidateRect
GetClientRect
ShowWindow
SendDlgItemMessageW
MapDialogRect
GetWindowRect
MapWindowPoints
GetWindowTextW
GetWindowTextLengthW
GetDlgItem
MessageBoxW
EndDialog
DialogBoxParamW
LoadImageW
GetWindow
EmptyClipboard
SetWindowLongW

gdi32

GetStockObject
DeleteObject
SetTextColor

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

SHBindToParent
SHGetDesktopFolder
ShellExecuteW
SHGetFileInfoW
ord155

ole32

OleInitialize
DoDragDrop
OleUninitialize

oleaut32

SysStringLen
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysFreeString

Exports

Exports

??1CWriteBuffer@@QAE@XZ
?AddBuffer@CZipBuffers@@QAE_NPBXIPBD@Z
?AnsiToUnicode@Convert@Util@@YA_NAAV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PBDH@Z
?Clear@CZipBuffers@@QAEXXZ
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
?DoFormatEx@CFmtString@@QAE?AV?$vector@UtagStringItem@@V?$allocator@UtagStringItem@@@std@@@std@@PB_W@Z
?Encode16@Encode@Util@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PBEH@Z
?GZip@CGZipBuffer@@QAE_NPAEI@Z
?GetBuffer@CUnzipBuffers@@QAE_NIAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetZip@CZipBuffers@@QAE_NAAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_N@Z
?Init@CUnzipBuffers@@QAE_NPBXI_N@Z
?MatchWildcard@FS@Util@@YAHPBD0@Z
?MatchWildcard@FS@Util@@YAHPB_W0@Z
?Uninit@CUnzipBuffers@@AAEXXZ
?Utf8FromWS@Convert@Util@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@PB_WH@Z
?Utf8FromWSLimit@Convert@Util@@YA?AV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@HPB_WH@Z
?Utf8ToWS@Convert@Util@@YA?AV?$CStringT@_WV?$StrTraitATL@_WV?$ChTraitsCRT@_W@ATL@@@ATL@@@ATL@@PBDH@Z
strlcat
strlcpy
wcslcat
wcslcpy

Sections

.text
Size: 172KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

��
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

617ccccf07fc8671c9e93b185d832685

Headers

File Characteristics

PDB Paths

Imports

version

dbghelp

wininet

psapi

comctl32

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

Exports

Exports

Sections

.text Size: 172KB - Virtual size: 171KB

.rdata Size: 44KB - Virtual size: 42KB

.data Size: 8KB - Virtual size: 12KB

.rsrc Size: 36KB - Virtual size: 33KB

�� Size: 20KB - Virtual size: 20KB

.text
Size: 172KB - Virtual size: 171KB

.rdata
Size: 44KB - Virtual size: 42KB

.data
Size: 8KB - Virtual size: 12KB

.rsrc
Size: 36KB - Virtual size: 33KB

��
Size: 20KB - Virtual size: 20KB